refactor(credentials): remove credential expiry support and API

The credential expiry feature has been removed from both the Rust
backend and the frontend. Stored credentials now include only
username and password.

- Remove expiresAt field from StoredCredential
- Simplify API by removing expiry param from credSave
- Drop expiry UI and expiry checks across the app

src-tauri/src/git.rs

@@ -2432,8 +2432,6 @@ const CRED_SERVICE: &str = "tauri_git_lite";
 pub struct StoredCredential {
     pub username: String,
     pub password: String,
-    #[serde(default, rename = "expiresAt", skip_serializing_if = "Option::is_none")]
-    pub expires_at: Option<String>,
 }
 
 fn cred_entry(key: &str) -> Result<keyring::Entry, String> {
@@ -2616,19 +2614,9 @@ pub fn cred_load(key: String) -> Result<Option<StoredCredential>, String> {
 }
 
 #[tauri::command(async)]
-pub fn cred_save(
-    key: String,
-    username: String,
-    password: String,
-    expires_at: Option<String>,
-) -> Result<(), String> {
+pub fn cred_save(key: String, username: String, password: String) -> Result<(), String> {
     let entry = cred_entry(&key)?;
-    let expires_at = expires_at.filter(|value| !value.trim().is_empty());
-    let cred = StoredCredential {
-        username,
-        password,
-        expires_at,
-    };
+    let cred = StoredCredential { username, password };
     let json = serde_json::to_string(&cred)
         .map_err(|err| format!("Could not serialize credentials: {err}"))?;
     entry

src/App.svelte

@@ -180,7 +180,6 @@
 
   import {
     orgKeyFromUrl,
-    isCredentialExpired,
     isAuthError,
     stripAuthPrefix,
     summarizeGitError,
@@ -2219,11 +2218,10 @@
 
     if (!username && !password) {
       const stored = await loadStoredCredential(credentialKey);
-      if (stored && !isCredentialExpired(stored)) {
+      if (stored) {
         await cloneRepo(remoteUrl, parentPath, directoryName, stored.username, stored.password, credentialKey, true);
         return;
       }
-      if (stored && credentialKey) await credDelete(credentialKey).catch(() => {});
     }
 
     operation = "Cloning repository";
@@ -2921,7 +2919,7 @@
     if (!activeRepoPath || isBusy) return;
     const key = await currentCredKey();
     const stored = await loadStoredCredential(key);
-    const credential = stored && !isCredentialExpired(stored) ? stored : null;
+    const credential = stored ?? null;
 
     await runOperation(`Pushing tag ${tag.name}`, async () => {
       try {
@@ -3028,12 +3026,7 @@
   async function storedCredentialForNoteRemote(remote: string, direction: "fetch" | "push") {
     const config = commitNoteRemotes.find((item) => item.name === remote);
     const key = orgKeyFromUrl(direction === "push" ? (config?.push_url ?? "") : (config?.fetch_url ?? ""));
-    const stored = await loadStoredCredential(key);
-    if (stored && isCredentialExpired(stored)) {
-      if (key) await credDelete(key).catch(() => {});
-      return null;
-    }
-    return stored;
+    return loadStoredCredential(key);
   }
 
   function commitNoteRemoteError(error: unknown): string {
@@ -3271,12 +3264,7 @@
     handleRemoteResult("push", key, fromStore);
   }
 
-  async function handleCredentialSubmit(
-    username: string,
-    password: string,
-    save: boolean,
-    expiresAt: string | null,
-  ) {
+  async function handleCredentialSubmit(username: string, password: string, save: boolean) {
     const key = credDialogKey;
     if (credDialogAction === "pull") await doActualPull(username, password, key, false);
     else if (credDialogAction === "push") await doActualPush(username, password, key, false);
@@ -3296,7 +3284,7 @@
     // Only persist once the operation actually succeeded (dialog has closed).
     if (!credDialogOpen && save && key) {
       try {
-        await credSave(key, username, password, expiresAt);
+        await credSave(key, username, password);
       } catch (error) {
         errorMessage = errorToMessage(error);
       }
@@ -3311,15 +3299,13 @@
     const key = await currentCredKey();
     const stored = await loadStoredCredential(key);
 
-    if (stored && !isCredentialExpired(stored)) {
+    if (stored) {
       if (action === "pull") await doActualPull(stored.username, stored.password, key, true);
       else if (action === "fetch") await doActualFetch(stored.username, stored.password, key, true);
       else await doActualPush(stored.username, stored.password, key, true);
       return;
     }
 
-    // Expired entry → clean it up before prompting again.
-    if (stored && key) await credDelete(key).catch(() => {});
     await openCredentialDialog(action, key);
   }
 

src/lib/components/AiSettingsDialog.svelte

@@ -85,7 +85,7 @@
     const key = CRED_KEYS[target];
     const trimmed = value.trim();
     if (trimmed) {
-      await credSave(key, "api-key", trimmed, null);
+      await credSave(key, "api-key", trimmed);
     } else {
       await credDelete(key);
     }

src/lib/components/CredentialDialog.svelte

@@ -17,7 +17,7 @@
     action: "push" | "pull" | "fetch" | "clone";
     error: string;
     isBusy: boolean;
-    onSubmit: (username: string, password: string, save: boolean, expiresAt: string | null) => void;
+    onSubmit: (username: string, password: string, save: boolean) => void;
     onCancel: () => void;
   }
 
@@ -36,7 +36,6 @@
   let password = $state("");
   let showPassword = $state(false);
   let saveSession = $state(true);
-  let expiresAt = $state("");
 
   let canSubmit = $derived(
     !isBusy &&
@@ -62,12 +61,7 @@
   function handleSubmit(e: SubmitEvent) {
     e.preventDefault();
     if (!canSubmit) return;
-    onSubmit(
-      mode === "token" ? "oauth2" : username,
-      password,
-      saveSession,
-      saveSession && expiresAt ? expiresAt : null,
-    );
+    onSubmit(mode === "token" ? "oauth2" : username, password, saveSession);
   }
 </script>
 
@@ -191,19 +185,6 @@
         </div>
       {/if}
 
-      {#if saveSession}
-        <div class="cred-expiry">
-          <label class="cred-field-label" for="cred-expiry">Expiration date (optional)</label>
-          <input
-            id="cred-expiry"
-            type="date"
-            bind:value={expiresAt}
-            disabled={isBusy}
-          />
-          <span class="cred-expiry-hint">After this date you'll automatically be asked to log in again.</span>
-        </div>
-      {/if}
-
       <div class="cred-footer">
         <label class="cred-save">
           <input type="checkbox" bind:checked={saveSession} disabled={isBusy} />

src/lib/credentials.ts

@@ -1,5 +1,3 @@
-import type { StoredCredential } from "./types";
-
 /**
  * Derives a credential key from a remote URL, scoped to host + organisation —
  * the same granularity Azure DevOps / GitHub use. Examples:
@@ -37,13 +35,6 @@ export function orgKeyFromUrl(raw: string): string | null {
   return org ? `${host}/${org}` : host;
 }
 
-/** A stored credential is expired only if it carries a past expiry date. */
-export function isCredentialExpired(cred: StoredCredential): boolean {
-  if (!cred.expiresAt) return false;
-  const time = new Date(cred.expiresAt).getTime();
-  return !Number.isNaN(time) && time < Date.now();
-}
-
 const AUTH_PREFIX = "AUTH_FAILED:";
 
 export function isAuthError(message: string): boolean {

src/lib/git.ts

@@ -381,13 +381,8 @@ export function credLoad(key: string): Promise<StoredCredential | null> {
   return invoke<StoredCredential | null>("cred_load", { key });
 }
 
-export function credSave(
-  key: string,
-  username: string,
-  password: string,
-  expiresAt: string | null,
-): Promise<void> {
-  return invoke<void>("cred_save", { key, username, password, expiresAt });
+export function credSave(key: string, username: string, password: string): Promise<void> {
+  return invoke<void>("cred_save", { key, username, password });
 }
 
 export function credDelete(key: string): Promise<void> {

src/lib/types.ts

@@ -310,5 +310,4 @@ export interface ReflogEntry {
 export interface StoredCredential {
   username: string;
   password: string;
-  expiresAt?: string | null;
 }